Bypassing Feature Squeezing by Increasing Adversary Strength

Abstract

Feature Squeezing is a recently proposed defense method which reduces the search space available to an adversary by coalescing samples that correspond to many different feature vectors in the original space into a single sample. It has been shown that feature squeezing defenses can be combined in a joint detection framework to achieve high detection rates against state-of-the-art attacks. However, we demonstrate on the MNIST and CIFAR-10 datasets that by increasing the adversary strength of said state-of-the-art attacks, one can bypass the detection framework with adversarial examples of minimal visual distortion. These results suggest for proposed defenses to validate against stronger attack configurations.

References in corpus (7)

• Adam: A Method for Stochastic Optimization
• Explaining and Harnessing Adversarial Examples
• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples

Cited by in corpus (12)

• On Evaluating Adversarial Robustness
• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• GenAttack: Practical Black-box Attacks with Gradient-Free Optimization
• Scratch that! An Evolution-based Adversarial Attack against Neural Networks
• Adversarial Sampling for Fairness Testing in Deep Neural Network
• RAID: Randomized Adversarial-Input Detection for Neural Networks
• On the Limitation of MagNet Defense against $L_1$-based Adversarial Examples
• Using Undervolting as an On-Device Defense Against Adversarial Machine Learning Attacks
• HoneyModels: Machine Learning Honeypots
• DeepSearch: A Simple and Effective Blackbox Attack for Deep Neural Networks
• CAAD 2018: Generating Transferable Adversarial Examples
• Stochastic-Shield: A Probabilistic Approach Towards Training-Free Adversarial Defense in Quantized CNNs